Stay secure · Managed SOC
A managed SOC that watches your business around the clock.
Our managed Security Operations Centre (SOC) gives you a full security operations team without building one. Analysts monitor your endpoints, network and Microsoft 365 every hour of every day on Microsoft Sentinel, investigate every alert and act the moment something looks wrong.
- 24/7/365 monitoring since 2022
- High-severity alerts investigated within 30 minutes
- Built on Microsoft Sentinel
- 150+ threat intelligence sources
What you get
Threats caught out of hours
Attacks rarely wait for office hours. Analysts watch nights, weekends and holidays, so nothing sits unnoticed until Monday.
Contained before they spread
A compromised device is isolated and a compromised account locked down quickly, so a problem on one machine stays on one machine.
Skills you would struggle to hire
Junior to senior analysts working as one team, with email security and vulnerability specialists joining major incidents.
What is included
- 24/7/365 monitoring of endpoints, network infrastructure, Microsoft 365 and Entra ID
- Managed detection and response (MDR): automatic session revocation, password resets and device isolation
- Investigation of every alert, with threat hunting across your estate
- Predefined incident playbooks for the main threat types, with custom playbooks available
- A root cause analysis report after every significant incident
- Dark web monitoring for leaked credentials and personal data
- Look-alike domain and typosquatting monitoring
- Detection of hacking tools and password crackers on your network
- Reporting on unapproved AI tools and shadow IT
- Endpoint agent health monitoring, leavers reports and Azure cost monitoring
- Monthly service reviews, with work to raise your Microsoft Secure Score
Who it is for
Organisations that need round-the-clock security monitoring but not the cost of building and staffing their own SOC, particularly those running on Microsoft 365 and in regulated sectors such as financial and legal services.
How it works
- 1
Prerequisites
We give you a checklist covering contacts, licensing, log sources and access, and help you work through it.
- 2
Audit and build
We audit your environment against the Conosco SOC standard, then build a fresh Microsoft Sentinel instance and connect your log sources.
- 3
Test and go live
Integrations are verified and detection rules tuned to your environment. Then analysts start watching around the clock.
- 4
Baseline and automate
For the first month analysts respond by hand while learning what normal looks like. Then automated response switches on.
Independently verified, continuously.
ISO 27001 certified since 2016, Cyber Essentials Plus, CREST-certified testers and an Assurix Trusted MSP.
See how we are verifiedQuestions we are often asked
What is a managed SOC?
A Security Operations Centre is a team of security analysts, with the tools to collect and analyse activity across your systems, who detect and respond to threats around the clock. A managed SOC is one run for you by a specialist provider, so you get the team, processes and technology without hiring them yourself.
What is the difference between a SOC, SIEM and MDR?
A SIEM (security information and event management) is the platform that collects and analyses log data; ours is Microsoft Sentinel. MDR (managed detection and response) is the automated containment that acts on a confirmed threat, such as isolating a device. The SOC is the team of analysts who use both, investigate what the tools find and decide what to do.
How quickly do you act on an alert?
For a high-severity alert, an analyst starts investigating within 30 minutes and confirms whether it is a real threat within four hours. Medium-severity alerts are picked up within 45 minutes and low-severity within an hour. We meet these targets in at least 90% of cases, measured each quarter.
What happens when the SOC detects an incident?
Analysts start a predefined playbook and contain the threat, for example by isolating a device or revoking a session. They then investigate how far it reached, what data was involved and whether it moved across your network, and you receive a root cause analysis report.
What Microsoft licences do we need?
The SOC runs on Microsoft Sentinel, so you need an Azure subscription. Monitoring Microsoft 365 and cloud sign-ins needs Microsoft Entra ID P2 (formerly Azure AD P2), AI tool reporting needs E3-level cloud app licensing, and multi-factor authentication must be on for every account. We review your licensing before onboarding and tell you exactly what, if anything, needs to change.
We already have a SIEM. Can you use it?
We run the SOC on our own standardised Microsoft Sentinel build, so we do not monitor other SIEM platforms. Existing Sentinel rules and playbooks can be moved across on request. Migrating from a different SIEM is a separate project.
What is not included?
The SOC is a monitoring and response service. Forensic investigations are handled by a specialist partner we can introduce. Setting up endpoint security, configuring data loss prevention, hardening Microsoft security settings and complex custom playbooks are scoped and priced separately.
How long does it take to get started?
Onboarding typically takes about three weeks, depending on how many systems are connected and how quickly the prerequisites are in place.
Often paired with
Talk to us.
A short, no-obligation conversation about what this would look like for your organisation.